Protection coordination technique for power converters

ABSTRACT

A control unit of an electrical system is described. The control unit causes some of the switches in a power converter of the electrical system to not be shut down and not conducting upon detection of a fault current caused by a line-to-line fault. Instead, the control unit causes at least one of the switches to be switched-on and conducting to allow the some of the fault current to flow through the at least one switch, before activating a protection device that creates an open circuit and breaks the fault.

TECHNICAL FIELD

The disclosure relates to fault protection for DC power converters.

BACKGROUND

Power converters, such as power converters used in high voltage directcurrent (HVDC) grids (e.g., found in some hybrid electric aircraft andother applications) may include some form of fault protection, forexample, to protect: the power converters, the power grid, or theequipment supplied by the grid, from overvoltage or overcurrentconditions caused by faults. For example, some fault protection systemsmay cause a power converter to open all of its internal power switches(e.g. insulated gate bipolar transistors (IGBT) or powermetal-oxide-semiconductor field-effect transistors (MOSFET)) to cause anopen circuit condition within the power converter itself, to preventdamage from a detected fault. However, this may not adequately protectagainst all faults, specifically line-line faults on the DC network.Therefore, dedicated DC circuit breakers may also be included in thecircuit, such as solid state circuit breakers (SSCB) or hybrid circuitbreaker (HCB)s, that are meant to trip i.e. open, during a fault andcause an open circuit condition to break a detected fault. Dedicatedfault protection devices, which may be capable of detecting a fault andabsorbing the fault energy, may be undesirable in some applicationsbecause dedicated fault protection devices may add weight, cost, andcomplexity to a system.

SUMMARY

In general, the disclosure is directed to techniques and systems fordynamically enabling a power converter (e.g., found in a vehicle system,power grid, or other application) to assist other protection devices inprotecting a circuit during a fault condition. In particular, thedescribed techniques may be particularly useful to protect a circuitfrom line-to-line faults that may occur between two transmission linesof a DC power grid. Unlike other fault protection responses that mightcommand the opening of all internal switches of the power converter inan attempt to isolate the fault, an example power converter may insteaddissipate energy built up during a fault by closing at least oneinternal switch, rather than opening all the internal switches, when aline-to-line fault occurs. By controlling an example power converter inthis way, any switch of the power converter that operates in aswitched-on or closed state, may dissipate a portion of a fault currentthat has built up in a circuit, during a fault. The example powerconverter may dissipate some of the fault current in this way, forexample, before activating a protection device (e.g., a breaker) thatbreaks the fault. With at least some of a fault current being dissipatedby the example power converter, an affected circuit can rely on lessrobust protection devices (e.g., breakers) down the line from theexample power converter, since the protection devices no longer need tobe able to handle an entire fault current during activation. Thistechnique may also enable mechanical contactor solutions for breakingfaults at higher voltage and higher currents as well as extend the lifeof existing mechanical contactor solutions. The techniques of thisdisclosure are applicable to both alternating current (AC) to DC powerconverters or DC/DC power converters.

In one example, the disclosure is directed to a method comprising:receiving, by a control unit of a power system, an indication of a faultcondition at the power system; in response to receiving the indication,verifying, by the control unit, that at least one switch of a powerconverter of the power system is conducting current; and after verifyingthat the at least one switch is conducting current, enabling, by thecontrol unit, a protection device that prevents the current from flowingout of the power converter.

In another example, the disclosure is directed to a control unit of anelectrical system that includes a power converter comprising at leastone switch configured to convert input power to an output power to aload, wherein the control unit is operatively coupled to the powerconverter and is configured to: receive an indication of a faultcondition within the electrical system, wherein the fault conditioncauses a fault current in the power converter; in response to receivingthe indication, verify that the at least one switch is conductingcurrent; and after verifying that the at least one switch is conductingcurrent, enable a protection device, wherein enabling the protectiondevice prevents the fault current from flowing from the power converterand to the load.

In another example, the disclosure is directed to a system comprising: ahigh voltage direct current (HVDC) grid; a power source; a protectiondevice; a power converter configured to supply DC power to the HVDCgrid, the power converter comprising: at least one switch configured toconvert input power from the power source into DC power; and a controlunit operatively coupled to the at least one switch, the control unitconfigured to: receive an indication of a fault condition within thesystem, wherein the fault condition causes a fault current in the powerconverter; in response to receiving the indication, verify that the atleast one switch is conducting current, such that at least a portion ofthe fault current flows through the at least one switch; after verifyingthat the at least one switch is conducting current, enable theprotection device, wherein enabling the protection device prevents thefault current from flowing from the power converter and to the HVDCgrid.

The details of one or more examples of the disclosure are set forth inthe accompanying drawings and the description below. Other features,objects, and advantages of the disclosure will be apparent from thedescription and drawings, and from the claims.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a block diagram illustrating an example electrical systemconfigured to implement fault protection, in accordance with techniquesof this disclosure.

FIG. 2A is a block diagram illustrating an example electrical systemwith an AC/DC power converter configured to implement fault protection,in accordance with techniques of this disclosure.

FIG. 2B is a block diagram illustrating an additional example electricalsystem with an AC/DC power converter configured to implement faultprotection, in accordance with techniques of this disclosure.

FIG. 3 is a block diagram illustrating an example electrical system witha DC/DC power converter configured to implement fault protection, inaccordance with techniques of this disclosure.

FIG. 4 is a flow chart illustrating example operations of an exampleelectrical system configured to perform fault protection, in accordancewith techniques of this disclosure.

DETAILED DESCRIPTION

In general, the disclosure is directed to techniques and systems fordynamically enabling a power converter (e.g., found in a vehicle system,power grid, or other application) to assist other protection devices inprotecting a circuit during a fault condition. Rather than isolate apower converter during a fault, an example electrical system relies onthe power converter to aid in handling the fault. That is, rather thanarbitrarily opening all the switches of a power converter to isolate thepower converter and other components during a line-to-line fault, theexample electrical system causes one or more switches of the powerconverter to be left closed to allow at least a portion of a faultcurrent to exit the electrical system through the one or more switches.The example electrical system may keep the one or more switches closedbriefly, and before activating a primary protection device (e.g., acircuit breaker) that can finally break the fault. In other words, theexample electrical system may utilize an existing power converter toprovide additional fault protection capability thereby enabling theexample electrical system to rely on less robust primary faultprotection devices than other electrical systems that rely on primaryfault protection devices alone.

FIG. 1 is a block diagram illustrating an example electrical systemconfigured to implement fault protection, in accordance with techniquesof this disclosure. In some examples, electrical system 10 (referred tosimply as “system 10”) may form part of a manned or unmanned vehiclesystem, such as an electrical system of an automobile or aircraft. Inother examples, system 10 may be part of a high voltage (HV) power grid,such as a HVDC power grid, which may part of a vehicle system. In someexamples, the meaning of the term “high voltage” may vary from industryto industry. For example, “high voltage” in the aerospace industry mayinclude systems that operate above 540V. Whereas for terrestrial powergrids, low voltage dc (LVDC) may be defined as voltage less than 1000V(i.e. one kV), while medium voltage DC (MVDC) may be considered forsystems that operate with voltages between 1 kV and 100 kV. Thetechniques of this disclosure may apply to systems considered HVDC, LVDCand MVDC. This disclosure uses the term HVDC systems to simplify theexplanation.

Electrical system 10 includes: power source 32, protection device 38,load 40, control unit 42 and power converter 35, which may includeswitches 34, filter 36. In some examples, system 10 may be subject to afault, such as line-to-line fault 20. Fault 20 may cause fault current,I_(FAULT) 26 to bypass load 40 and at least partially reduce the loadcurrent, LOAD 44.

Power source 32 supplies power to electrical system 10 and load 40, e.g.I_(OUT) 28. Power source 32 may be an AC or DC power source. Examples ofpower source 32 as an AC power source may include an AC generator, suchas powered by a gas turbine or other motor. An AC generator may be asingle phase or multiple phase generator, such as a three-phasegenerator. Examples of power source 32 as a DC power source may includea fuel cell, a battery or a DC/DC converter.

Load 40 may include any type of load that uses DC power. In someexamples, load 40 may include an HVDC power grid, which supplies avariety of other loads. Some examples of other loads include equipmentsuch as avionics, e.g. weather radar, navigation equipment, andcommunication equipment, lighting, food preparation appliances, pumps,and similar equipment. The equipment may include, or be served by, otherpower converters to change the voltage on the HVDC grid to the voltagetype and level used by the equipment. For example, a compartment lightmay run on 12 V DC and the output of power converter 35 may supply 200 VDC. The compartment light may include a DC/DC power converter to reducethe 200 V DC to the 12 V DC needed to run the compartment light.

Protection device 38 is a primary protection device of electrical system10. Protection device 38 protects electrical system 10 from faults, suchas fault 20, by breaking fault current (I_(FAULT)) 26. Protection device38 may include any type of device configured to disconnect a powersupply from a load in the event of an overvoltage, overcurrent or othertypes of faults. Some examples of protection devices include a fuse, asolid state circuit breakers (SSCB), hybrid circuit breaker (HCB)s andfast mechanical disconnect (FMD). Protection device 38 is configured tocreate an open circuit to break fault current I_(FAULT) 26 and preventfault current I_(FAULT) 26 from damaging electrical system 10.

Control unit 42 controls the components of electrical system 10 to causeelectrical system 10 to distribute electrical power to load 4. Controlunit 42 may send and receive signals to and from power converter 35, toprotection device 38, and in some cases, power source 32 and load 40. Insome examples, load 40 may send signals to control unit 42 to increaseor decrease the power output to load 40. Control unit 42 may locatedanywhere such that control unit 42 can communicate with the componentsof electrical system 10. For example, control unit 42 may be integratedwith power converter 35, part of power source 32, or part of othercircuitry that controls and monitors an aircraft or other vehicle inwhich electrical system 10 is installed.

Control unit 42 may include one or more processors and a memory.Examples of processor in control unit 42 may include any one or more ofa microcontroller (MCU), e.g. a computer on a single integrated circuitcontaining a processor core, memory, and programmable input/outputperipherals, a microprocessor (μP), e.g. a central processing unit (CPU)on a single integrated circuit (IC), a controller, a digital signalprocessor (DSP), an application specific integrated circuit (ASIC), afield-programmable gate array (FPGA), a system on chip (SoC) orequivalent discrete or integrated logic circuitry. A processor may beintegrated circuitry, i.e., integrated processing circuitry, and thatthe integrated processing circuitry may be realized as fixed hardwareprocessing circuitry, programmable processing circuitry and/or acombination of both fixed and programmable processing circuitry.

Control unit 42 may be operatively connected to switches 34 andprotection device 38. Control unit 42 may receive signals from switches34 and protection device 38 as well as send control signals to switches34 and protection device 38. For example, control unit 42 may receive anindication of the state of the one or more switches in switches 34, suchas whether a switch is open, and not conducting current, or a switch isclosed, and conducting current. Control unit 42 may also monitor theoutput voltage (V_(OUT)) 25 and current (I_(OUT)) 28 from powerconverter 35 via voltage and current sensors (not shown in FIG. 1).

Power converter 35 converts power supplied by power source 32 accordingto the requirements of load 40. Examples of power converter 35 includean AC/DC converter, a DC/DC converter, or any other type of powerconverter with one or more switches that can be controlled during afault to dissipate at least a portion of fault current 26.

Power converter 35 may include one or more switches 34 and filter 36.Switches 34 are controlled by control unit 42 to convert input powerfrom power source 32 to an output power that is delivered to load 40.Switches 34 may include one or more pairs of high-side and low-sideswitches used to convert an AC power from power source 32 to a DC powerat a predetermined output voltage and current to be used by load 40.Similarly, in the example of a DC power source, power converter 35 maybe a DC/DC power converter such as a buck converter, boost converter,buck-boost converter, or an isolated power converter such as a flybacktopology power converter, or any other similar topology, that converts aDC power from power source 32 to a different form of DC power used byload 40. In some examples, switches 34 may include one or more energyabsorption devices. Some examples of energy absorption devices mayinclude a metal oxide varistor (MOV) or a transient voltage suppression(TVS) diode.

Filter 36 filters the converted power being output from power converter35. Filter 36 includes components that when combined with switches 34,convert input power from power source 32 to the desired output voltageand current. In the example where power converter 35 is a DC/DC buckconverter, filter circuit 36 may include an inductor, a diode and acapacitor connected between switches 34 and load 40 (not shown in FIG.1). In other examples of power converter 35, filter circuit 36 mayinclude other components such as a transformer, primary side switch,synchronous rectification switch and other components not shown in FIG.1.

In operation, control unit 42 may send control signals to protectiondevice 38. Protection device 38 may receive a signal from control unit42 to enable protection device 38 (e.g., by causing an open circuit),which causes protection device 38 to isolate power converter 35 fromload 40 to break a detected fault, such as line-to-line fault 20.Protection device 38 may receive a reset signal from control unit 42 toreconnect power converter 35 to load 40 (e.g., by closing the opencircuit). For example, control unit 42 may receive an indication thatfault 20 has been cleared and that it is safe to reconnect powerconverter 35 to load 40. Once fault 20 has been cleared, control unit 42may send the reset signal to protection device 38 to reconnect powerconverter 35 to load 40. An FMD may have an advantage over a dedicatedfault protection device, such as a SSCB, because an FMD may be lesscostly and weigh less than an SSCB, or other types of dedicated faultprotection device.

In the example of FIG. 1, fault 20 is a line-to-line fault. Fault 20 maybe caused by a short circuit in a piece of equipment connected to anHVDC power grid, a fault within power converter 25, a fault in thewiring that supplies the loads in load 40, such as an insulation failurebetween the power and ground lines, or by some other cause. Fault 20 mayresult in a fault current, depicted by I_(FAULT) 26. I_(FAULT) 26 maybypass portions of load 40, depending on the location of fault 20. Undernormal operating conditions, current from power converter 35 passesthrough load 40, as indicated by I_(LOAD) 44. By enabling protectiondevice 38 to disconnect power converter 35 from load 40, control unit 42may stop both I_(FAULT) 26 and I_(LOAD) 44.

In normal operation (i.e., when no fault conditions exist at electricalsystem 10), electrical system 10 may receive power from power source 32,convert the power to a predetermined voltage and current, and supply theconverted power to load 40, via protection device 38. For example,control unit 42 may send control signals to power switches 34 that causepower switches 34 to open and close in a particular way for convertingthe power being output by power source 32 into power with a voltage, acurrent, and frequency required by load 40.

However, during a fault condition, control unit 42 may receive anindication of the fault condition. For example, control unit 42 mayreceive e.g., from a current sensor not shown in FIG. 1, an indicationof a current level flowing out of power converter 35. Control unit 42may determine that the current level represents a fault condition, e.g.fault 20, such as by determining that the current level exceeds apredetermined acceptable current level associated with power converter35.

In response to detecting fault 20, control unit 42 may reconfigurecomponents of electrical system 10 to prevent fault 20 from damagingelectrical system 10. In particular, control unit 42 may controlswitches 34 to reduce an amount of fault current I_(FAULT) 26 associatedwith fault condition 20, for instance, prior to enabling protectiondevice 38. In this way, a lower rated protection device 38 may be used,thereby reducing weight, cost, and complexity of electrical system 10.

To prevent damage from fault condition 20, control unit 42 may verifywhether at least one switch of switches 34 is closed and conductingcurrent. If none of switches 34 is closed, control unit 42 may send asignal to close at least one switch from switches 34. By closing atleast one of switches 34, control unit 42 may cause at least a portionof the fault current to flow through the at least one switch, andrecirculate through power source 32 as I_(RECIRC) 22, rather than exitpower converter 35 towards protection device 38. In other words, byclosing at least one switch and allowing a portion of the fault currentto recirculate back through power source 32, control unit 42 reduces themagnitude of the remaining fault current flowing through protectiondevice 38 as I_(OUT) 28. Reducing the amount of remaining fault currentthat may flow through protection device 38 during a fault event enableselectrical system 10 to rely on a lower rated type of protection device38 that may be less expensive and lower in weight than other protectiondevices.

In some examples, control unit 42 may control the operation of eachswitch of switches 34, for example by controlling the gate of an IGBT ora MOSFET. In examples in which control unit 42 controls the operation ofthe switches in switches 34, control unit 42 may verify the state ofeach switch, e.g. open or closed, by determining the state of the signalcontrolling the gate of the switch. In other examples, control unit 42may receive signals from a current sensor in the path of a switch inswitches 34. Some examples of a current sensor for a switch may includea shunt resistor, or a signal from a switch that includes currentsensing capability, such as a current sensing MOSFET. Control unit 42may verify the state of each switch by determining whether current isflowing in the path of the switch. In other examples, power converter 35may send a signal to control unit 42 about the state of a switch ofswitches 34. Control unit 42 may verify that at least one switch ofswitches 34 is conducting a portion of the fault current based on thesignal from power converter 35.

After verifying that the at least one switch of switches 34 isconducting a portion of the fault current and allowing the portion ofthe fault current to recirculate through power source 32, control unit42 may enable protection device 38. Enabling protection device 38 maydisconnect power converter 35 from load 40 and prevent the fault currentfrom flowing from power converter 35. Reducing the magnitude of theremaining fault current through protection device 38 may mean thatprotection device 38 does not need to be rated to absorb all the energyfrom the fault current when control unit 42 enables protection device38, as the fault current is allowed to commutate into the closedswitches 34. In some examples, control unit 42 may enable protectiondevice 38 when the portion of the fault current through protectiondevice 38 is less than or equal to a predetermined current. Once controlunit 42 enables protection device 38 and breaks the fault current,control unit 42 may open all the switches in switches 34.

In this manner system 10 may provide advantages over other types offault protection systems that allow all the fault current to flowthrough the protection device. In other types of fault protectionsystems that allow all the fault current to flow through the protectiondevice, the protection device may detect the fault current anddisconnect the power supply from the load, but the fault current may be,for example, more than twice the rated current for the power supply.That is, unlike other fault protection systems that relies on adedicated protection device alone to break the fault current, an exampleelectrical system that uses the described techniques may perform faultprotection with less sophisticated, less costly, or lighter faultprotection devices.

In other words, the combination of turning on some of the switches inthe power converter, and absorbing energy caused by the fault conditionmay result in allowing a protection device that does not need to becapable of absorbing all the fault energy. Therefore, the protectiondevice may be an FMD rather than a SSCB or HCB. The fault protectioncontrol scheme, using an FMD, may provide several advantages over acircuit breaker or other techniques of fault protection. Some advantagesmay include improved reliability and reduced cost and weight whencompared to other techniques. Improved reliability and reduced weightmay be desirable in power systems on aircraft, including unmanned aerialsystems (UAS) or other vehicles. An FMD may be less complex and weighless than other types of protection devices. Improved reliability maycome from allowing the fault current to commutate into the closedswitches before and during the FMD opening, rather than opening the FMDunder the full fault current, which forces the FMD to absorb the entirefault energy and may limit the life of the FMD. In some cases, for veryhigh fault current, the FMD may be not be capable of breaking the faultwithout assistance from the power converter switches.

FIG. 2A is a block diagram illustrating an example electrical systemwith an AC/DC power converter configured to implement fault protection,in accordance with techniques of this disclosure. Electrical system 50depicted in FIG. 2A is an example of system 10 described above inrelation to FIG. 1.

Electrical system 50 (referred to simply as “system 50”) includes: powersource 52, protection device 60, load 64, control unit 62 and powerconverter 53, which may include high side switches 54, low side switches56, and filter 58. Power source 52, protection device 60, load 64,control unit 62, and power converter 53, are, respectively, examples ofpower source 32, protection device 38, load 40, control unit 42, andpower converter 35 of FIG. 1. As such, the characteristics and functionsof power source 52, protection device 60, load 64, control unit 62, andpower converter 53 may be similar or the same as the characteristics andfunctions of, respectively, power source 32, protection device 38, load40, control unit 42, and power converter 35 of FIG. 1.

In some examples, system 50 may be subject to a fault, such asline-to-line fault 55. As with fault 20 described above in relation toFIG. 1, fault 55 may cause fault current, I_(FAULT) 26 to bypass load 64and at least partially reduce the load current, I_(LOAD) 66.

AC power source 52 supplies power to electrical system 50 and load 64,e.g. I_(OUT) 68. Examples of AC power source 52 include a single phaseor multiple phase generator. Similar to load 40 of FIG. 1, load 64 mayinclude any type of load that uses DC power including an HVDC powergrid. Protection device 60 is a primary protection device of electricalsystem 50.

Control unit 62 may control at least some of the components ofelectrical system 50. Control unit 62 may send and receive signals toand from power converter 53, protection device 60, and in some cases, ACpower source 52 and load 64.

Power converter 53 converts power supplied by AC power source 52according to the requirements of load 64. Power converter 53 is an AC/DCpower converter which rectifies and conditions the AC power to a DCoutput power (i.e. output voltage, V_(OUT) 65, and output current,I_(OUT) 68). In some examples, such as for a vehicle power system,system 50 may supply DC output power at high voltages, e.g. in thehundreds of volts or for low voltages, or a 12 or 24 V system such asfor an automobile. For some applications a high voltage system, such asan HVDC grid may have advantages compared to lower voltage systems, suchas a 12 volt DC system. For example, higher voltage systems may use areduced cable weight when compared to low voltage systems. Also, theelectrical converter architecture for converters inside individual loadson the HVDC grid may be build lighter when using, for example a +/−270 VDC supply. In the example of an aircraft, a traditional auxiliary powerunit (APU) may be replaced by a multifunctional fuel cell system, whichmay reduce pollution during ground operation.

Some examples of AC/DC power converters, such as power converter 53depicted in FIG. 2A, may include high side switches 54 and low sideswitches 56 to rectify and control the output power of power converter53. In the example of system 50, control unit 62 may include current orvoltage sensing capability to monitor the output power of powerconverter 53 and adjust the switching duty cycle and frequency of highside switches 54 and low side switches 56 to maintain the desired outputvoltage 65 and output current 68.

Filter 58 includes components that when combined with high side switches54 and low side switches 56, convert input power from AC power source 52to the desired DC output voltage and current. Filter 58 may includecomponents arranged to increase the AC output voltage from AC powersource 52 to a higher DC output voltage 65. In other examples, filter 58may include components arranged to decrease the AC output voltage fromAC power source 52 to a lower DC output voltage 65.

Similar to described above for system 10 in FIG. 1, during normaloperation (i.e., no fault conditions exist at electrical system 50),electrical system 50 may receive power from AC power source 52, convertthe AC power to a predetermined DC voltage and current, and supply theconverted power to load 64, via protection device 60. Control unit 62may receive signals from components (not shown in FIG. 2A) that monitorthe operation of system 50, such as output current 68 and output voltage65.

During a fault condition, control unit 62 may receive an indication ofthe fault condition, e.g. fault 55, based on, for example, detecting anovercurrent condition in system 50. In response, control unit 62 mayverify that the at least one switch of high side switches 54 or low sideswitches 56 are closed and conducting current. Control unit 62 mayverify the state of high side switches 54 or low side switches 56 asdescribed above in relation to FIG. 1. When control unit 62 receives anindication of the fault condition one or more switches of high sideswitches 54 or low side switches 56 may be closed because of normalswitching operation. As described above in relation to FIG. 1, closingat least one switch and allowing a portion of fault current 26 torecirculate back through AC power source 52, may reduce the magnitude ofthe remaining fault current flowing through protection device 60 asI_(OUT) 68. In some examples, control unit 62 may send a signal to closeat any remaining switches of low side switches 56 that are not alreadyclosed, such that at least a portion of fault current 26 flows throughlow side switches 56 and recirculates through AC power source 52 asI_(RECIRC) 22. In other examples, control unit 62 may send a signal toclose any remaining high side switch 54 and open any low side switches56 that are not already open. In other examples, control unit 62 maysend a signal to close at any remaining switches of both high sideswitches 54 as well as low side switches 56 that are not already closedto ensure that at least a portion of fault current 26 flows through bothhigh side switches 54 and low side switches 56 and recirculates throughAC power source 52. In other examples, control unit 62 may cycle betweenclosing all the high side switches 54 and opening the low side switches56, then opening all the high side switches 54 and closing the low sideswitches 56. In this manner, by cycling the fault current between thehigh side switches 54 and the low side switches 56, control unit 62 maymore evenly distribute any thermal load caused by the fault currentamong all the switches.

After verifying that the selected switches are closed and conducting aportion of fault current 26 and allowing the portion of fault current 26to recirculate through AC power source 52, control unit 42 may enableprotection device 60. Protection device 60 may receive a signal fromcontrol unit 62 to enable protection device 60, which causes protectiondevice 60 to isolate power converter 53 from load 64 to break thedetected fault. As described above in relation to FIG. 1, the reducedmagnitude fault current (e.g. I_(OUT) 68) through protection device 60may mean that protection device 60 does not need to be rated to absorball the energy from the fault current when control unit 42 enablesprotection device 60. Once control unit 62 enables protection device 60and breaks the fault current, control unit 60 may open all the switchesof high side switches 54 and low side switches 56.

FIG. 2B is a block diagram illustrating an additional example electricalsystem with an AC/DC power converter configured to implement faultprotection in accordance with techniques of this disclosure. Electricalsystem 100 (referred to as system 100) operates in a similar manner tosystems 10 and 50 described above in relation to FIGS. 1 and 2A. System100 is just one possible example implementation of an AC/DC powerconverter circuit supplying a load. In other examples, AC/DC powerconverters may include different components and configurations andremain within the scope of this disclosure.

System 100 includes: AC power source 120, protection device 104, HVDCgrid 102, control unit 112 and power converter 108, which may includeswitches T1-T6, and filter circuit 130. AC power source 120, protectiondevice 104, HVDC grid 102, control unit 112, and power converter 108,are, respectively, examples of power source 32, protection device 38,load 40, control unit 42, and power converter 35 of FIG. 1. As such, thecharacteristics and functions of AC power source 120, protection device104, HVDC grid 102, control unit 112, and power converter 108 may besimilar or the same as the characteristics and functions of,respectively, power source 32, protection device 38, load 40, controlunit 42, and power converter 35 of FIG. 1.

In some examples, system 10 may be subject to a fault, such asline-to-line fault 20. Fault 20 may cause fault current, I_(FAULT) 26,to bypass load of HVDC grid 102 and at least partially reduce the loadcurrent.

AC power source 120 supplies power to electrical system 100 and HVDCgrid 102, e.g. I_(OUT) 110. AC power source 120 is a three-phase ACgenerator and may be powered for example by a gas turbine and in someexamples may include an APU. In the example of system 100, AC source 120is Y-connected with each phase connected to a switch node between pairsof high side and low side switches.

Similar to loads 40 and 64 described above in relation to FIGS. 1 and2A, HVDC grid 102 receives power from power converter 108 and may supplya variety of other loads connected to HVDC grid 102. HVDC grid 102 maybe installed in a vehicle, such as an aircraft, watercraft, or othertype of vehicle, as well as installed for other applications thatsupport DC loads.

Protection device 104 protects electrical system 100 from faults, suchas fault 105, by breaking fault current (I_(FAULT)) 26. In the exampleof system 100, protection device 38 is an FMD, or similar deviceconfigured to disconnect power converter 108 from HVDC grid 102 uponreceiving a control signal from control unit 112 that enables protectiondevice 104.

Control unit 112 controls the components of electrical system 100,similar to control units 42 and 62 described above in relation to FIGS.1 and 2A. Control unit 112 may send and receive signals to and frompower converter 108, protection device 104, and in some cases, AC powersource 120 and HVDC grid 102. Control unit 112 may send control signalsto and receive sensing signals from switches T1-T6 via sense and controllines 114. For example, control unit 112 may control the switchingfrequency, on-time, duty cycle and other operating characteristics ofswitches T1-T6 by controlling the voltage applied to the gates ofswitches T1-T6. Control unit 112 may also sense the status (e.g.on-state or off-state) of each switch, the magnitude of current througheach switch, a drain-source voltage (V_(DS)), temperature and othersensing signals either directly from switches T1-T6 or from sensingcomponents near switches T1-T6.

Similar to control unit 42 depicted in FIG. 1 and control unit 62depicted in FIG. 2, control unit 112 may also monitor and control otheroperating parameters and components of system 100. For example, controlunit 112 may monitor the output current (I_(OUT)) 110, output voltageand other operating parameters. As one example, power converter 108 mayinclude one or more sensors, such as voltage and current sensor 180,which may send signals to control unit 112. Voltage and current sensor180 may include a voltage divider and a shunt resistor, or some othertechniques of measuring voltage and current. System 100 may also includeother sensors, not shown in FIG. 2B. Control unit 112 may also controlthe operation of protection device 104 as well as receive signals fromprotection device 104, such as a signal indicating the state ofprotection device 104 (e.g. closed and conducting current or engaged andnot conducting current).

Power converter 108 converts power supplied by AC power source 120 tosupply the requirements of HVDC grid 102. Power converter 108 is anexample implementation of an AC/DC power converter, similar to powerconverter 53 described above in relation to FIG. 2A. Like powerconverter 53, power converter 108 rectifies and conditions the AC powerfrom AC power source 120 to a DC output power. Power converter 108includes filter circuit 130 and switches T1-T6.

Switches T1-T6 of power converter 108 are depicted as IGBTs, with thegate of each IGBT connected to control unit 112 via sense and controllines 114. For clarity, the connections to the gates of each IGBT arenot shown in FIG. 2B. In other examples, switches T1-T6 may also beimplemented with any other type of switch, including a MOSFET. Thecollectors of high side switches T1, T2 and T3 connect to a common node170 that connects to a first terminal of protection device 104. Theemitters of low side switches T4, T5 and T6 connect to a common node 172that also connects to an output terminal of power converter 108. In someexamples node 172 may be considered a ground or reference node. Theemitter of high side switch T1 connects to the collector of low sideswitch T4 as well as to the A winding 174 of AC source 120 at switchnode A of the pair formed by high side T1 and low side switch T4.Current i_(A) 122 flows to A winding 174 from switch node A. Similarly,the emitter of high side switch T2 connects to the collector of low sideswitch T5 as well as to the B winding 176 of AC source 120 at switchnode B of the pair formed by high side T2 and low side switch T5.Current i_(B) 124 flows to B coil 176 from switch node B. The emitter ofhigh side switch T3 connects to the collector of low side switch T6 aswell as to the C winding 178 of AC source 120 at switch node C of thepair formed by high side T3 and low side switch T6. Current i_(C) 126flows to C coil 178 from switch node C.

In the example of system 100, each IGBT of switches T1-T6 includes afreewheeling diode connected anti-parallel across each IGBT that allowssome reverse current flow and passive rectification during some phasesof power converter 108 operation. In example of switches T1-T6implemented as MOSFETs, the body diode of the MOSFET may perform asimilar function.

Each switch T1-T6 also includes an energy absorption device 140-152connected in parallel across each switch. In the example of system 100,the energy absorption device is an MOV. Specifically, MOV 140 connectsin parallel with T1 between node 170 and switch node A, MOV 142 connectsin parallel with T2 between node 170 and switch node B, MOV 144 connectsin parallel with T3 between node 170 and switch node C, MOV 148 connectsin parallel with T4 between node 172 and switch node A, MOV 150 connectsin parallel with T5 between node 172 and switch node B, MOV 152 connectsin parallel with T6 between node 172 and switch node C.

The resistance of an MOV decreases as voltage magnitude increases. AnMOV acts as an open circuit during normal operating voltages andconducts current during voltage transients or an elevation in voltageabove the rated maximum continuous operating voltage (MCOV). In otherwords, the MOV may limit the voltage across each switch. In otherexamples a TVS diode may be used in place of the MOV depicted in system100. A TVS diode is a voltage clamping device that operates by shuntingexcess current when the induced voltage exceeds the avalanche breakdownpotential of the TVS diode. The TVS diode is a clamping device,suppressing all overvoltages above its breakdown voltage. The TVS diodemay automatically reset when the overvoltage is reduced below apredetermined voltage threshold but may absorbs at least a portion ofany transient energy internally.

As with filter 58 described above in relation to FIG. 2A, filter circuit130 includes components that when combined with high side switches T1-T3and low side switches T4-T6, convert input power from AC power source120 to the desired DC output voltage and output current 110. Filtercircuit 130 may receive current Inc 106 from switches T1-T6 andcondition the current as needed to supply HVDC grid 102. In someexamples, as shown in FIG. 2B, filter circuit 130 may include componentsarranged to increase the AC output voltage from AC power source 120 to ahigher DC output voltage. One terminal of inductor L1 134 connects tonode 170. The opposite terminal of inductor L1 134 connects to capacitorC1 138 through resistor R1 136. The opposite terminal of capacitor C1138 connects to node 172. In other words, the series configuration ofinductor L1 134, resistor R1 136 and capacitor C1 138 connects node 170to node 172. Capacitor C_(DC) 132 also connects node 170 to node 172 andprovides voltage smoothing for power converter 108.

In operation, system 100 functions the same as system 50 described abovein relation to FIG. 2A. That is, during normal (i.e., no fault)operation system 100 may receive power from AC power source 120, convertthe AC power to a predetermined DC voltage and current, and supply theconverted power to HVDC grid 102, via protection device 104.

During a fault condition, control unit 112 may receive an indication ofthe fault condition. For example, control unit 112 may receive e.g.,from voltage and current sensor 180, an indication of a current levelflowing out of power converter 108. Control unit 112 may determine thatthe current level represents a fault condition, e.g. fault 105, such asby determining that the current level indicated by voltage and currentsensor 180 exceeds a predetermined acceptable current level associatedwith power converter 108.

In response to detecting fault 105, control unit 112 may reconfigurecomponents of electrical system 100 to prevent fault 105 from damagingelectrical system 100. In particular, control unit 112 may controlswitches T1-T6 to reduce an amount of fault current I_(FAULT) 26associated with fault condition 105, for instance, prior to enablingprotection device 104. In this way, a lower rated protection device 104may be used, thereby reducing weight, cost, and complexity of electricalsystem 100.

To prevent damage from fault condition 105, control unit 112 may verifywhether may verify that the at least one switch of high side switchesT1-T3 or low side switches T4-T6 are closed and conducting current. Byclosing at least one switch, control unit 112 may cause at least aportion of fault current 26 to recirculate back through AC power source120, i.e. as currents i_(A) 122, i_(B) 124, and i_(C) 126, rather thanexit power converter 35 towards protection device 38. In other words, byclosing at least one switch and causing some of the fault current torecirculate through AC power source 120, may reduce the magnitude of theremaining fault current flowing through protection device 104 as I_(OUT)110. As with system 50, control unit 112 may send a signal to close atany remaining switches of low side switches T4-T6 that are not alreadyclosed, such that at least a portion of fault current 26 flows throughlow side switches and recirculates through AC power source 120. In otherexamples, as described above in relation to FIG. 2A, control unit 112may instead send a signal to close at any remaining switches of highside switches T1-T3 that are not already closed, such that at least aportion of fault current 26 flows through high side switches andrecirculates through AC power source 120. In other examples, controlunit 112 may send a signal to control all of switches T1-T6, or cyclebetween closing high side switches T1-T3 and low side switches T4-T6.Once control unit 112 enables protection device 104 and breaks the faultcurrent, control unit 112 may open all the switches T1-T6 and preventthe switches from conducting any current.

As discussed above, one advantage of using an FMD as a protection devicemay include reduced weight when compared with other types of protectiondevices. In the example of system 100 installed on an aircraft, weightsavings may have a positive “snowball effect”. For example, savingweight in the installed equipment may lead to a possible weightreduction of the aircraft structure and the engine. In other words, byreducing the equipment weight, the structure needed to support theequipment, and the engine power needed to fly the aircraft may also bereduced. That is, a kilogram of equipment weight savings may result inmore than a kilogram of weight savings for the entire vehicle, which mayresult in lower fuel consumption and an improved performance.

FIG. 3 is a block diagram illustrating an example electrical system witha DC/DC power converter configured to implement fault protection, inaccordance with techniques of this disclosure. The function andcharacteristics of system 300 are similar to the function andcharacteristics of system 10 described above in relation to FIG. 1.

Electrical system 300 includes: DC power source 320, protection device304, HVDC grid 302, control unit 312 and power converter 308. DC powersource 320, protection device 304, HVDC grid 302, control unit 312 andpower converter 308, are, respectively, examples of power source 32,protection device 38, load 40, control unit 42, and power converter 35of FIG. 1. As such, the characteristics and functions of power DC powersource 320, protection device 304, HVDC grid 302, control unit 312 andpower converter 308 may be similar or the same as the characteristicsand functions of, respectively, power source 32, protection device 38,load 40, control unit 42, and power converter 35 of FIG. 1. In someexamples, system 300 may be subject to a fault, such as line-to-linefault 305, which may result in fault current, I_(FAULT) 26.

Power source 320 supplies power to electrical system 300 and HVDC grid302, e.g. I_(OUT) 310. Examples of power source 320 may include abattery, or similar energy storage element or another DC/DC converter.

Protection device 304 is a primary protection device of electricalsystem 300 and is implemented as an FMD in the example of FIG. 3.

Control unit 312 monitors the parameters and controls the components ofelectrical system 300. Control unit 112 may send and receive signals toand from power converter 108, protection device 104, and in some cases,AC power source 120 and HVDC grid 102. Control unit 312 may also connectto switch 340 via sense and control lines 314. Sense and control lines314 may also connect to other sensors, e.g. temperature and voltagesensors, not shown in FIG. 3.

Power converter 308 converts power supplied by DC power source 320 tosupply the requirements of HVDC grid 302. The example of power converter108 is implemented as a boost DC/DC converter. However, in otherexamples, other types of DC/DC converters may also use the faultprotection techniques of this disclosure. Power converter 308 includesswitch 340, MOV 342 and filtering components inductor L2 334, diode D2336 and capacitor C2 338. Inductor L2 334 connects the positive terminalof DC power source 320 to a first terminal of switch 340 and to theanode of diode D2 336. The cathode of diode D2 336 connects toprotection device 304 and to capacitor C2 338. The opposite terminal ofcapacitor C2 338 connects to a second terminal of switch 340 and to thenegative terminal of DC power source 320. In some examples the negativeterminal of DC power source 320 may be considered a system ground.

Power converter 308 also includes MOV 342, which connects in parallelacross switch 340. As with MOVs 140-152, described above in relation toFIG. 2B, MOV 342 is an energy absorption device associated with switch340 that may limit the voltage across switch 340. In other examples aTVS diode may be used in place of MOV 342.

During normal operation, switch 340, in conjunction with inductor L2334, diode D2 336 and capacitor C2 338 boosts the DC voltage output fromDC power source 320 to a higher DC voltage, which is then output to HVDCgrid 302. The magnitude of the increased DC voltage depends on thevalues of the capacitance of capacitor C2 338, inductance of inductor L2334 and the switching characteristics (e.g. frequency, duty cycle, etc.)of switch 340 as controlled by control unit 312.

Similar to system 10 described above in relation to FIG. 1, during afault condition control unit 312 may receive an indication of the faultcondition. For example, control unit 312 may receive e.g., from acurrent sensor not shown in FIG. 3, an indication of a current levelflowing out of power converter 308. Control unit 112 may determine thatthe current level represents a fault condition, e.g. fault 305 bydetermining the current level exceeds a predetermined acceptable currentlevel associated with power converter 308 or HVDC grid 302.

In response to detecting fault 305, control unit 312 may reconfigurecomponents of electrical system 300 to prevent fault 305 from damagingelectrical system 300. In particular, control unit 312 may close switch340 to reduce an amount of fault current I_(FAULT) 26 associated withfault condition 305, for instance, prior to enabling protection device304. In this way, a lower rated protection device 304 may be used,thereby reducing weight, cost, and complexity of electrical system 300.

To prevent damage from fault condition 305, control unit 312 may verifywhether switch 340 is closed and conducting current. If switch 340 isnot closed, control unit 312 may send a signal to close switch 340.Closing switch 340 may cause a portion of fault current 26 torecirculate back through DC power source 320, i.e. as I_(RECIRC) 322,rather than exit power converter 35 towards protection device 38. Inother words, by closing switch 340 some of the fault current mayrecirculate through DC power source 320 and reduce the magnitude of theremaining fault current flowing through protection device 304 as I_(OUT)310. Once control unit 312 enables protection device 304 and breaks thefault current, control unit 312 may signal switch 340 to open, whichprevents the switch 340 from conducting the recirculating current,I_(RECIRC) 322.

FIG. 4 is a flow chart illustrating example operations of an exampleelectrical system configured to perform fault protection, in accordancewith techniques of this disclosure. The blocks of FIG. 4 will bedescribed in terms of FIGS. 1 and 2B unless otherwise noted.

During normal operation (i.e., when no fault conditions, such as fault20 exists) electrical system 10, depicted in FIG. 1 may convert powerreceived from power source 32 and supply the converted power to load 40via protection device 38. During a fault condition, control unit 42 mayreceive an indication of the fault condition at the power system, e.g.fault 20 (400). In some examples control unit 42 may detect anovercurrent condition at the output of power converter 35 caused byfault 20.

In response to detecting a fault, control unit 42 may verify that the atleast one switch of switches 34 is closed and conducting current (402).The switches of switches 34 may open and close periodically duringnormal operation, as described above in relation to FIGS. 2B and 3.

In some examples control unit 42 may determine that one or more switchesthat should be conducting current during a fault condition are notalready closed (NO branch of 404). If at least one switch that should beclosed is not closed, control unit 42 may send a signal to close theswitch (406). Closing the desired switches of the power converter allowsa portion of the fault current to flow through the closed switches andrecirculates through power source 32 as I_(RECIRC) 22 (408). Similarly,as described above in relation to FIG. 2B, closing the desired switchesmay allow current to recirculate through AC power source 120 as currentsi_(A) 122, i_(B) 124, and i_(C) 126.

If the desired switches are already closed, (YES branch of 404), andallowing a portion of the fault current to recirculate back throughpower source 32 (408), may reduce the magnitude of the remaining faultcurrent flowing through protection device 38 as I_(OUT) 28.

After verifying that the at least one switch of switches 34 isconducting a portion of the fault current and allowing the portion ofthe fault current to recirculate through power source 32, control unit42 may enable protection device 38 (410). In some examples, protectiondevice 38 is an FMD. As described above in relation to FIG. 1, enablingprotection device 38 may disconnect power converter 35 from load 40 andprevent the fault current from flowing from power converter 35. Thereduced magnitude of remaining fault current through protection device38 at the time control unit 42 enables may mean that protection device38 does not need to be rated to absorb all the energy from the faultcurrent when control unit 42 enables protection device 38. In someexamples, enabling a protection device may be referred to as trippingthe protection device. In some examples, switches 34 may also include anenergy absorption device, such as MOV 140-152 depicted in FIG. 2B. AnMOV or TVS diode may absorb and/or dissipate remaining energy that maydamage switches 34 during a fault condition.

Once control unit 42 enables protection device 38 and breaks the faultcurrent, control unit 42 may open all the switches in switches 34 (412).With all switches in switches 34 open, current is prevented from flowingfrom power converter 35 to load 40. Control unit 42 may keep switches 34open until the cause of fault 20 is resolved.

In one or more examples, the functions described above may beimplemented in hardware, software, firmware, or any combination thereof.For example, control unit 42 in FIG. 1 may be implemented in hardware,software, firmware, or any combination thereof. If implemented insoftware, the functions may be stored on or transmitted over, as one ormore instructions or code, a computer-readable medium and executed by ahardware-based processing unit. Computer-readable media may includecomputer-readable storage media, which corresponds to a tangible mediumsuch as data storage media, or communication media including any mediumthat facilitates transfer of a computer program from one place toanother, e.g., according to a communication protocol. In this manner,computer-readable media generally may correspond to (1) tangiblecomputer-readable storage media which is non-transitory or (2) acommunication medium such as a signal or carrier wave. Data storagemedia may be any available media that can be accessed by one or morecomputers or one or more processors to retrieve instructions, codeand/or data structures for implementation of the techniques described inthis disclosure. A computer program product may include acomputer-readable medium.

By way of example, and not limitation, such computer-readable storagemedia, may comprise RAM, ROM, EEPROM, or any other medium that can beused to store desired program code in the form of instructions or datastructures and that can be accessed by a computer. Also, any connectionis properly termed a computer-readable medium. For example, ifinstructions are transmitted from a website, server, testing equipmentor other remote source using a coaxial cable, fiber optic cable, twistedpair, digital subscriber line (DSL), or wireless technologies such asinfrared, radio, and microwave, then the coaxial cable, fiber opticcable, twisted pair, DSL, or wireless technologies such as infrared,radio, and microwave are included in the definition of medium. It shouldbe understood, however, that computer-readable storage media and datastorage media do not include connections, carrier waves, signals, orother transient media, but are instead directed to non-transient,tangible storage media. Combinations of the above should also beincluded within the scope of computer-readable media.

Instructions may be executed by one or more processors, such as one ormore DSPs, general purpose microprocessors, ASICs, FPGAs, or otherequivalent integrated or discrete logic circuitry, as described above inrelation to FIG. 1. Accordingly, the term “processor,” as used herein,such as a processor included in control unit 42, may refer to any of theforegoing structure or any other structure suitable for implementationof the techniques described herein. In addition, the techniques could befully implemented in one or more circuits or logic elements.

The techniques of this disclosure may be implemented in a wide varietyof devices or apparatuses, including an integrated circuit (IC) or a setof ICs (e.g., a chip set). Various components, modules, or units aredescribed in this disclosure to emphasize functional aspects of devicesconfigured to perform the disclosed techniques, but do not necessarilyrequire realization by different hardware units. Rather, as describedabove, various units may be combined in a hardware unit or provided by acollection of interoperative hardware units, including one or moreprocessors as described above, in conjunction with suitable softwareand/or firmware.

The techniques of this disclosure may also be described in the followingexamples.

Example 1

A method comprising: receiving, by a control unit of a power system, anindication of a fault condition at the power system; in response toreceiving the indication, verifying, by the control unit, that at leastone switch of a power converter of the power system is conductingcurrent; and after verifying that the at least one switch is conductingcurrent, enabling, by the control unit, a protection device thatprevents the current from flowing out of the power converter.

Example 2

The method of example 1, wherein the fault condition results in a faultcurrent, wherein enabling the protection device comprises determining,by the control unit, whether the fault current is less than or equal toa predetermined current, wherein enabling the protection device is inresponse to the control unit determining that the fault current is lessthan or equal to the predetermined current.

Example 3

The method of any combination of examples 1-2, after verifying that theat least one switch is conducting, refraining, by the control unit, fromenabling the protection device that prevents the current from flowingout of the power converter prior to determining that the fault currentis less than or equal to the predetermined current.

Example 4

The method of any combination of examples 1-3, wherein the powerconverter comprises an alternating current (AC) power source andwherein, during the fault condition, a portion of the fault currentrecirculates through the AC power source.

Example 5

The method of any combination of examples 1-4, wherein the powerconverter comprises a direct current (DC) power source and wherein,during the fault condition, a portion of the fault current recirculatesthrough the DC power source.

Example 6

The method of any combination of examples 1-5, wherein the powerconverter further comprises an energy absorption device associated withthe at least one switch, wherein the energy absorption device limits avoltage across the at least one switch.

Example 7

The method of any combination of examples 1-6, further comprising, inresponse to enabling the protection device, preventing, by the controlunit, the at least one switch from conducting the current.

Example 8

A control unit of an electrical system that includes a power convertercomprising at least one switch configured to convert input power to anoutput power to a load, wherein the control unit is operatively coupledto the power converter and is configured to: receive an indication of afault condition within the electrical system, wherein the faultcondition causes a fault current in the power converter; in response toreceiving the indication, verify that the at least one switch isconducting current; and after verifying that the at least one switch isconducting current, enable a protection device, wherein enabling theprotection device prevents the fault current from flowing from the powerconverter and to the load.

Example 9

The control unit of example 8, wherein the control unit enables theprotection device when the fault current is less than or equal to apredetermined current.

Example 10

The control unit of any combination of examples 8-9, wherein the powerconverter device is operatively coupled to an alternating current (AC)power source, the power converter device receives the input power fromthe AC power source; and the at least one switch is a low side switch;the device further comprising a high side switch operatively coupled tothe AC power source, the high side switch and the low side switchconfigured to convert the input power to the output power; wherein thecontrol unit is further configured to: in response to receiving theindication, verify that the low side switch is turned on, and the highside switch is not conducting current, such that at least a portion ofthe fault current flows through the low side switch; and after enablingthe protection device, preventing the low side switch from conductingcurrent.

Example 11

The control unit of any combination of examples 8-10, wherein during thefault condition, a portion of the fault current recirculates through theAC power source.

Example 12

The control unit of any combination of examples 8-11, wherein the highside switch and the low side switch are selected from a group comprisingat least one of: an insulated gate bipolar transistor (IGBT) or ametal-oxide-semiconductor field-effect transistor (MOSFET).

Example 13

The control unit of any combination of examples 8-12, wherein the powerconverter device is operatively coupled to a direct current (DC) powersource; the power converter device receives the input power from the DCpower source; and wherein, during the fault condition and beforeenabling the protection device, a portion of the fault currentrecirculates through the DC power source.

Example 14

The control unit of any combination of examples 8-13, wherein thecontrol unit is further configured to, after enabling the protectiondevice, preventing the at least one switch from conducting current.

Example 15

The control unit of any combination of examples 8-14, wherein the powerconverter device further comprises an energy absorption deviceassociated with the at least one switch, wherein the energy absorptiondevice limits a voltage across the at least one switch.

Example 16

The control unit of any combination of examples 8-15, wherein theprotection device is a fast mechanical disconnect (FMD) device.

Example 17

The control unit of any combination of examples 8-16, wherein the faultcondition is a line-to-line fault.

Example 18

A system comprising: a high voltage direct current (HVDC) grid; a powersource; a protection device; a power converter configured to supply DCpower to the HVDC grid, the power converter comprising: at least oneswitch configured to convert input power from the power source into DCpower; and a control unit operatively coupled to the at least oneswitch, the control unit configured to: receive an indication of a faultcondition within the system, wherein the fault condition causes a faultcurrent in the power converter; in response to receiving the indication,verify that the at least one switch is conducting current, such that atleast a portion of the fault current flows through the at least oneswitch; after verifying that the at least one switch is conductingcurrent, enable the protection device, wherein enabling the protectiondevice prevents the fault current from flowing from the power converterand to the HVDC grid.

Example 19

The system of example 18, wherein the power source is an alternatingcurrent (AC) power source; the at least one switch is a low side switch;the power converter further comprising a high side switch operativelycoupled to the AC power source, the high side switch and the low sideswitch are configured to convert the input power to the DC power;wherein the control unit is further configured to: in response toreceiving the indication, verify that at least one of the low sideswitch or the high side switch is conducting current such that at leasta portion of the fault current flows through the low side switch or thehigh side switch and recirculates through the AC power source; afterverifying that the low side switch is conducting current, enable theprotection device; and after enabling the protection device, prevent thelow side switch from conducting current.

Example 20

The system of any combination of examples 18-19, wherein the controlunit is further configured to, in response to receiving the indication,verify that both the low side switch and the high side switch isconducting current such that at least a portion of the fault currentflows through both the low side switch and the high side switch andrecirculates through the AC power source.

Example 21

The system of any combination of examples 18-20, wherein the powersource is a direct current (DC) power source, during the fault conditionand before enabling the protection device, a portion of the faultcurrent recirculates through the DC power source, and the control unitis further configured to, after enabling the protection device, turn offthe at least one switch to prevent the at least one switch fromconducting current.

Example 22

The system of any combination of examples 18-21, wherein the powerconverter further comprises an energy absorption device associated withthe at least one switch, wherein the energy absorption device limits avoltage across the at least one switch, and the protection device is afast mechanical disconnect (FMD) device.

Example 23

The system of any combination of examples 18-22, wherein the system ispart of an aircraft or other type of manned or unmanned vehicle.

Various examples of the disclosure have been described. These and otherexamples are within the scope of the following claims.

The invention claimed is:
 1. A method comprising: receiving, by acontrol unit of a power system, an indication of a fault condition atthe power system; in response to receiving the indication, verifying, bythe control unit, that at least one switch of a power converter of thepower system is conducting current, wherein verifying that the at leastone switch of the power converter of the power system is conductingcurrent comprises: determining the state of the signal controlling thegate of the at least one switch; and receive signals from a currentsensor in the path of the at least one switch; and after verifying thatthe at least one switch is conducting current, enabling, by the controlunit, a protection device that prevents the current from flowing out ofthe power converter.
 2. The method of claim 1, wherein the faultcondition results in a fault current, wherein enabling the protectiondevice comprises determining, by the control unit, whether the faultcurrent is less than or equal to a predetermined current, whereinenabling the protection device is in response to the control unitdetermining that the fault current is less than or equal to thepredetermined current.
 3. The method of claim 2, further comprising:after verifying that the at least one switch is conducting, refraining,by the control unit, from enabling the protection device that preventsthe current from flowing out of the power converter prior to determiningthat the fault current is less than or equal to the predeterminedcurrent.
 4. The method of claim 1, wherein the power converter comprisesan alternating current (AC) power source and wherein, during the faultcondition, a portion of the fault current recirculates through the ACpower source.
 5. The method of claim 1, wherein the power convertercomprises a direct current (DC) power source and wherein, during thefault condition, a portion of the fault current recirculates through theDC power source.
 6. The method of claim 1, wherein the power converterfurther comprises an energy absorption device associated with the atleast one switch, wherein the energy absorption device limits a voltageacross the at least one switch.
 7. The method of claim 1, furthercomprising, in response to enabling the protection device, preventing,by the control unit, the at least one switch from conducting thecurrent.
 8. A control unit of an electrical system that includes a powerconverter comprising at least one switch configured to convert inputpower to an output power to a load, wherein the control unit isoperatively coupled to the power converter and is configured to: receivean indication of a fault condition within the electrical system, whereinthe fault condition causes a fault current in the power converter; inresponse to receiving the indication, verify that the at least oneswitch is conducting current, wherein verifying that the at least oneswitch of the power converter of the power system is conducting currentcomprises: determining the state of the signal controlling the gate ofthe at least one switch; and receive signals from a current sensor inthe path of the at least one switch; and after verifying that the atleast one switch is conducting current, enable a protection device,wherein enabling the protection device prevents the fault current fromflowing from the power converter and to the load.
 9. The control unit ofclaim 8, wherein the control unit enables the protection device when thefault current is less than or equal to a predetermined current.
 10. Thecontrol unit of claim 8, wherein: the power converter device isoperatively coupled to an alternating current (AC) power source, thepower converter device receives the input power from the AC powersource; and the at least one switch is a low side switch; the devicefurther comprising a high side switch operatively coupled to the ACpower source, the high side switch and the low side switch configured toconvert the input power to the output power; wherein the control unit isfurther configured to: in response to receiving the indication, verifythat the low side switch is turned on, and the high side switch is notconducting current, such that at least a portion of the fault currentflows through the low side switch; and after enabling the protectiondevice, preventing the low side switch from conducting current.
 11. Thecontrol unit of claim 10, wherein, during the fault condition, a portionof the fault current recirculates through the AC power source.
 12. Thecontrol unit of claim 10, wherein the high side switch and the low sideswitch are selected from a group comprising at least one of: aninsulated gate bipolar transistor (IGBT) or a metal-oxide-semiconductorfield-effect transistor (MOSFET).
 13. The control unit of claim 8,wherein: the power converter device is operatively coupled to a directcurrent (DC) power source; the power converter device receives the inputpower from the DC power source; and wherein, during the fault conditionand before enabling the protection device, a portion of the faultcurrent recirculates through the DC power source.
 14. The control unitof claim 13, wherein, the control unit is further configured to, afterenabling the protection device, preventing the at least one switch fromconducting current.
 15. The control unit of claim 8, wherein the powerconverter device further comprises an energy absorption deviceassociated with the at least one switch, wherein the energy absorptiondevice limits a voltage across the at least one switch.
 16. The controlunit of claim 8, wherein the protection device is a fast mechanicaldisconnect (FMD) device.
 17. The control unit of claim 8, wherein thefault condition is a line-to-line fault.
 18. A system comprising: a highvoltage direct current (HVDC) grid; a power source; a protection device;a power converter configured to supply DC power to the HVDC grid, thepower converter comprising: at least one switch configured to convertinput power from the power source into DC power; and a control unitoperatively coupled to the at least one switch, the control unitconfigured to: receive an indication of a fault condition within thesystem, wherein the fault condition causes a fault current in the powerconverter; in response to receiving the indication, verify that the atleast one switch is conducting current, such that at least a portion ofthe fault current flows through the at least one switch, whereinverifying that the at least one switch of the power converter of thepower system is conducting current comprises: determining the state ofthe signal controlling the gate of the at least one switch; and receivesignals from a current sensor in the path of the at least one switch;after verifying that the at least one switch is conducting current,enable the protection device, wherein enabling the protection deviceprevents the fault current from flowing from the power converter and tothe HVDC grid.
 19. The system of claim 18, wherein: the power source isan alternating current (AC) power source; the at least one switch is alow side switch; the power converter further comprising a high sideswitch operatively coupled to the AC power source, the high side switchand the low side switch are configured to convert the input power to theDC power; wherein the control unit is further configured to: in responseto receiving the indication, verify that at least one of the low sideswitch or the high side switch is conducting current such that at leasta portion of the fault current flows through the low side switch or thehigh side switch and recirculates through the AC power source; afterverifying that the low side switch is conducting current, enable theprotection device; and after enabling the protection device, prevent thelow side switch from conducting current.
 20. The system of claim 19,wherein the control unit is further configured to, in response toreceiving the indication, verify that both the low side switch and thehigh side switch is conducting current such that at least a portion ofthe fault current flows through both the low side switch and the highside switch and recirculates through the AC power source.
 21. The systemof claim 18, wherein: the power source is a direct current (DC) powersource, during the fault condition and before enabling the protectiondevice, a portion of the fault current recirculates through the DC powersource, and the control unit is further configured to, after enablingthe protection device, turn off the at least one switch to prevent theat least one switch from conducting current.
 22. The system of claim 18,wherein: the power converter further comprises an energy absorptiondevice associated with the at least one switch, wherein the energyabsorption device limits a voltage across the at least one switch, andthe protection device is a fast mechanical disconnect (FMD) device.